REMARKS 



I. Comments on Examiner's Statement of "Reasons for Allowance" 

In the Examiner's statement of "Reasons for Allowance," the Examiner states that 
the term "privacy-related action" is defined on page 4 of the specification, paragraph 2, 
which reads as follows: 

The rules model is based on a limited set of privacy-related 
actions: access, disclose, release, notify, utilize, update, withdraw consent, 
give consent, delete, anonymize, depersonalize and repersonalize. These 
actions are related to services provided by the Data Subject (in the case of 
release or give consent), a Party (in the case of notify), or a Data User (all 
the other actions). Authorization for an action is obtained by calling the 
corresponding get_X_Auth actions (getAccessAuth, getDiscloseAuth,...) 
on the relevant Filled Form. This authorization is granted or denied, 
depending on the relevant rules in the Filled Form. Besides grant or denial 
of authorization, the outcome may include an obligation or suggestion to 
do some additional task. 

While this section of the specification does give examples of privacy related 
actions that may be used in an exemplary embodiment of the present invention, the 
claims are not limited to the exemplary privacy-related actions set forth in the example 
embodiment described on page 4 of the present specification. In fact, the independent 
claims do not recite any of the specific actions set forth on page 4, paragraph 2 but 
instead only reference privacy-related actions. While the term "privacy-related actions" 
may indeed encompass those actions specifically set forth on page 4, paragraph 2, the 
term is broad enough to cover other privacy-related actions as well. 

Applicants respectfully submit that the Examiner is improperly reading in 
limitations from the specification into the claims. The invention as recited in the 
independent claims is not limited to only privacy-related actions selected from the list of 
access, disclose, release, notify, utilize, update, withdraw consent, give consent, delete, 
anonymize, depersonalize and repersonalize. Furthermore, the invention as recited in the 
independent claims does not require that all of these listed privacy-related actions be 
present in the claimed subject matter. 
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The Examiner states that the independent claims "explicitly" include the actions 
of disclose, release, notify, utilize, update, withdraw consent, give consent, delete, 
anonymize, depersonalize, and repersonalize. None of these actions are explicitly recited 
in any of the claims. To the contrary, the claims recite "privacy-related actions" which 
may include one or more of such actions, but just as well may include other privacy- 
related actions in addition to, or in replacement of, one or more of these actions listed in 
the specification. Thus, the Examiner's statement that the claims "explicitly" recite these 
actions is simply erroneous. The claims neither explicitly nor implicitly recite these 
actions, despite the allegations of the Examiner. 

It should be noted that Applicants' argument, submitted with the Preliminary 
Amendment filed August 23, 2005, states that Kido does not teach or suggest the features 
of (1) constructing a rule for each of said privacy-related actions, wherein each rule 
defines an action corresponding to an associated privacy-related action, a logical 
condition that identifies a condition under which a particular decision is generated, and a 
decision indicating a manner by which said associated privacy-related action is to be 
performed; (2) determining if said set of rules includes at least one rule having an action 
corresponding to an action specified in the request, a condition that evaluates to "true," 
and a decision that indicates that the action is authorized; or (3) selecting a rule in the set 
of rules that has an action corresponding to said action specified in the request, said 
condition that evaluates to "true," and said decision that indicates that the action is 
authorized and providing an output based on selecting said rule in the set of rules. It is 
for these reasons that the present claims are allowable, not the reading in of limitations 
from the specification, as asserted by the Examiner in the "Reasons for Allowance." 
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II. Conclusion 



For the reasons stated above, Applicants disagree with the Examiner's Reasons 
for Allowance. To the contrary, Applicants respectfully submit that the present claims 
are allowable over the prior art of record for the enumerated reasons above. 
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